JP2013168092A - Electronic equipment, soft error resistance evaluation system and evaluation method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide electronic equipment, an evaluation system and an evaluation method for improving reliability in soft error resistance evaluation.SOLUTION: An electronic equipment 1 includes: an information control unit 2 having error detection means for detecting an error; a unit control part 3 having a reboot control part for, on the basis of the error information of the information control unit, transmitting the reboot start signal of the information control unit in which an error is generated; and a signal transmission part 4 for detecting the reboot start signal from the unit control part, and for transmitting a signal to the outside when detecting the reboot start signal. When an error is generated in the information control unit, the information control unit is rebooted in accordance with the reboot start signal, and the signal is transmitted to the outside by the signal transmission part.

Description

  The present invention relates to an electronic device, a soft error tolerance evaluation system, and an evaluation method.

  With the miniaturization and high integration of semiconductor devices, the problem of environmental radiation soft errors is expanding. An environmental radiation soft error is a phenomenon in which data held in logic and memory is inverted by radiation such as alpha rays and neutron rays existing in nature. A soft error is a transient failure and is distinguished from a hard error in which the hardware fails permanently. Conventionally, a soft error is mainly caused by 1-bit inversion in a memory device, but in recent years, a phenomenon in which a plurality of bits are inverted at once or a held data inversion in a logic circuit such as a flip-flop has become apparent.

  In addition, there is a concern about an increase in intermittent system failures caused by the above-mentioned environmental radiation soft error in an electronic device operating in a mission critical system, and the soft error resistance of the electronic device, that is, the soft error rate (SER: Soft). Error Rate is becoming an important indicator of system reliability.

  There are two main methods for evaluating the soft error rate: field testing and acceleration testing with an accelerator. The field test is a method of evaluating an actual soft error occurrence rate by operating a plurality of and a plurality of types of evaluation objects for a long time in a general installation environment. On the other hand, the acceleration test using an accelerator is a method for evaluating a soft error rate in a short time by forcibly irradiating an evaluation target with a large amount of artificially generated radiation using a particle accelerator.

As literature regarding the soft error tolerance evaluation, Japanese Patent Application Laid-Open No. 2004-125633
There exists patent document 1). In this publication, “a first step of obtaining a soft error rate by installing and operating in an actual use environment of a semiconductor device, and irradiating each of the semiconductor devices with a neutron beam having a different energy, respectively. A second step of obtaining a corresponding cross-sectional area of the soft error of the semiconductor device, and a step of calculating a soft error rate of the semiconductor device from the structure and operation information of the semiconductor device and a spectrum of cosmic ray neutrons in the actual use environment A third step comprising calculating a cross-sectional area of the soft error of the semiconductor device from the spectrum of the neutron beam having different energy and the soft error rate of the semiconductor device obtained by the first step; The semiconductor device calculated by the third step A fourth step of comparing a soft error rate, a cross-sectional area of the soft error of the semiconductor device obtained by the second step, and a cross-sectional area of the soft error of the semiconductor device calculated by the third step The fifth step of comparing the calculation method, the sixth step of confirming the accuracy of the calculation method and the result in the third step by the fourth step and the fifth step, and the accuracy by the sixth step The software derived from the cosmic ray neutron in the arbitrary use environment of the arbitrary semiconductor device from the structure and operation information of the arbitrary semiconductor device and the spectrum of the cosmic ray neutron in the arbitrary use environment by the calculation method in the confirmed third step A method for evaluating resistance to soft errors caused by cosmic ray neutrons in a semiconductor device, comprising a seventh step of calculating an error rate. " It has been.

  In recent years, there is JP-A-8-287030 (Patent Document 2) as a document relating to a highly reliable apparatus for error. This publication states that “in a multi-computer system, when a system down occurs, the stopped CPU is automatically restarted to increase the operating rate of the system and improve the reliability”.

JP 2004-125633 A JP-A-8-287030

  Here, according to the field test, since the environmental radiation existing in the natural world is used, the true soft error rate possessed by the evaluation object can be obtained. However, in order to collect the number of data with sufficient reliability (number of errors), a large number of evaluation samples and annual test time are required. On the other hand, in the accelerated test, the characteristics of the environmental radiation to be irradiated (energy distribution, etc.) cannot be completely reproduced, so a true soft error rate cannot be obtained, but an approximate soft error rate can be estimated in a few hours. .

  Even today, memory-based devices that can provide a large number of samples have been subjected to long-term field tests, but it is difficult to perform field tests on all products, and acceleration tests using an accelerator are generally used for soft error resistance evaluations. Is.

  When the evaluation target is an electronic device, in the conventional soft error resistance evaluation, measurement is performed by continuously irradiating the neutron beam 105a, and when the system error occurs, manually stop the neutron beam 105a and restart the device. Was.

  In addition, while soft error tolerance evaluation is required at the device level, particularly in mission-critical high-reliability devices, an increasing number of devices adopt a redundant configuration. Also, in programming devices such as FPGAs, in order to reduce failures caused by neutron soft errors, an example in which a logic unit to be mounted has a redundant configuration is increasing.

  An example of a redundant configuration is a dual hot standby configuration. In the dual hot standby configuration, the devices are duplicated, and both devices perform the same operation while performing synchronous control with each other as an active system and a standby system. Normally, it is operating in the running system, but when an abnormality is detected in the running system, it immediately switches to the standby system, and the system on which the error is detected returns to normal by restarting etc. and waits again. By operating as a system, the normal operation of the system is maintained and the reliability of the device is improved.

  Further, as an example of a redundant configuration in a programmable device such as an FPGA, there is a high reliability method in which the logic unit is TMR (triple majority) and further combined with a partial reconfiguration technique. According to this configuration, even if one of the three logic parts becomes an error, the erroneous output is masked by the majority output, and the normal circuit is also reconfigured for the error logic part by partial reconfiguration. High reliability can be achieved by reprogramming.

However, there is a problem that the soft error rate cannot be correctly measured by the evaluation method based on the conventional acceleration test with respect to the apparatus having the redundant configuration as described above and restarted or reconfigured during operation.
In the soft error acceleration test, the time until a soft error occurs due to forced irradiation of the neutron beam is shortened, but recovery processing such as restart and reconfiguration requires a certain amount of time depending on the hardware. Therefore, in the above hot standby configuration, if an error occurs in the running system before the normal switching of the unit that has been switched over and becomes the standby system is complete, or the unit that is being restarted becomes an error again As a result, the possibility of multiple error occurrences such as the above becomes higher, and the soft error rate cannot be evaluated correctly.

  In the conventional evaluation method for a single electronic device, the neutron beam was manually stopped every time a system error occurred, and the device was returned to normal operation. Since it was not known whether it was executed, there was a problem that the beam could not be stopped in time for normal return.

  Accordingly, an object of the present invention is to provide an electronic device, an evaluation system, and an evaluation method that can improve the reliability in the soft error tolerance evaluation.

  In order to solve the above-described problems, the configuration described in the scope of claims is taken. As an example, for example, an information control unit that is an electronic device and includes an error detection unit that detects an error, and a reboot start signal of an information control unit in which an error has occurred is based on error information of the information control unit. A unit control unit having a reboot control unit for transmitting, a signal transmission unit for detecting a reboot start signal from the unit control unit and transmitting a signal to the outside when the reboot start signal is detected, and the information When an error occurs in the control unit, the information control unit is rebooted by the reboot start signal, and a signal is transmitted to the outside by the signal transmission unit.

  According to the present invention, it is possible to improve the reliability of the soft error resistance evaluation of an electronic device.

It is the figure which showed the structural example of the soft error tolerance evaluation system in the case of evaluating the double type | system | group hot standby component apparatus which is Embodiment 1 of this invention. It is the figure which showed the structural example of the information control unit in Embodiment 1 of this invention. It is the figure which showed the structural example of the redundant unit control part in Embodiment 1 of this invention. It is the figure which showed the structural example of the beam stop signal generation part in Embodiment 1 of this invention. It is the flowchart which showed the example of the flow of the soft error tolerance evaluation method in Embodiment 1 of this invention. It is the figure which showed the structural example of the beam stop signal generation part in Embodiment 3 of this invention. It is the figure which showed the structural example of the soft error tolerance evaluation system which evaluated FPGA of the TMR circuit structure which is Embodiment 2 of this invention. It is the figure which showed the structural example of the beam stop signal generation part in Embodiment 2 of this invention. It is the flowchart which showed the example of the flow of the soft error tolerance evaluation method in Embodiment 2 of this invention. The structural example of the conventional soft error tolerance evaluation system (soft error acceleration test) when evaluating an electronic device is shown. It is the flowchart which showed the example of the flow of the conventional soft error tolerance evaluation method (soft error acceleration test) when evaluating an electronic device.

First, a soft error tolerance evaluation system using an accelerator will be described with reference to FIGS.
The evaluation targets in general soft error acceleration tests are mainly memory devices such as SRAM and DRAM. The evaluation method is to continue irradiating neutrons, irradiating neutron dose (fluence) and bit inversion number (error In recent years, not only evaluation of a single device but also evaluation of soft error resistance of an entire electronic device assembled as a system has been performed.

  FIG. 10 shows a configuration example of a conventional soft error tolerance evaluation system (soft error acceleration test) when the evaluation target is an electronic device such as an information control device. Moreover, the example in case the environmental radiation to irradiate is a neutron beam is shown.

  In this evaluation system, the electronic device 200 is forcibly irradiated with the neutron beam 105a generated by the irradiation system 101, and the system error generated in the electronic device 200 is observed (the error type and the number of occurrences are measured). The neutron soft error rate in the electronic device 200 is evaluated.

  Further, the electronic device 200 has a built-in diagnostic unit 201, and can detect a hardware failure or a temporary operation abnormality. The electronic device 200 can be operated via the GUI screen of the control terminal 201. Information such as the status of the electronic device 200 and system errors can be collected from the control terminal 201.

  An irradiation system 101 in FIG. 10 is a system that generates a neutron beam, and includes an accelerator 102, a beam stop mechanism 103, a detector 104, a target 105, and a collimator (not shown).

  Although not shown, the accelerator 102 in the irradiation system 101 accelerates protons input from an external generation source, and generates a proton beam 102a. The accelerated proton beam 102a irradiates the target 105. When a proton collides with a target 105 formed of tungsten, lead, lithium, or the like, a neutron beam 105a is generated by a nuclear spalation reaction.

  The neutron beam 105a is applied to the electronic device 200 to be evaluated. Although not shown, partial irradiation is possible by shaping the irradiation shape of the neutron beam with a shield called a collimator.

  The beam stop mechanism 103 arranged on the proton beam line is a mechanism for stopping the output of the neutron beam. In this figure, according to the beam stop signal 107a from the control terminal 107, the output of the neutron beam 105a is stopped by blocking the proton beam 102a.

  In this example, when the level of the beam stop signal 107a is high (H), the proton beam 102a is interrupted and the output of the neutron beam 105a is stopped. Moreover, the irradiation flux amount (fluence) of the neutron beam 105a is measured by the detector 104 arranged further downstream of the beam stop mechanism 103. The detector 102 in this figure estimates the fluence of the neutron beam 105a output after the nuclear reaction between the target 105 and the proton by measuring the number of protons irradiated to the target 105.

FIG. 11 shows an example of a conventional soft error tolerance evaluation flow when the evaluation target is an electronic device.
Although not shown in the flow, first, the electronic device to be evaluated is activated with the neutron beam 105a from the irradiation system 101 stopped (S300).

Next, the apparatus is initialized and the operation is started (S301).
Here, the operation is preferably an operation that applies the same load as in actual use, but it may be a state in which a test program for shipping verification or a general benchmark program is executed. If the electronic apparatus 200 operates normally, the beam stop signal 107a is canceled from the control terminal 107, and irradiation with the neutron beam 105a is started (S302).

When irradiation with the neutron beam 105a is started, monitoring is continued from the control terminal 201 until a failure such as a system error occurs in the electronic device (S303).
Here, when a system error occurs in the electronic apparatus 200, the neutron beam 105a is immediately stopped (S304).

Next, all the information related to the error including the status of the system at that time is collected from the electronic device 200 (S305).
After collecting the error information, the electronic device 200 is rebooted (S306).

  The reboot in the present invention includes restarting, reconfiguration, and the like, and refers to an operation of recovering an error and returning to normal, and has the same meaning in the following embodiments.

  Next, remeasurement is determined, and if remeasurement is performed, the process returns to S301 and measurement is continued. In general, this routine is repeated several times to several tens of times to obtain error information. When the re-measurement is not performed, the acceleration test is terminated as it is (S307).

  Hereinafter, Example 1 of the present invention will be described with reference to FIGS. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

  In the first embodiment of the present invention, as an example of a redundant configuration electronic device to be evaluated, a device having a dual hot standby configuration is targeted, and the reliability of the soft error resistance evaluation of this device is improved. An example of an electronic device, an evaluation system, and an evaluation method in soft error tolerance evaluation that can be performed will be described.

  FIG. 1 is a diagram illustrating a configuration example of a soft error tolerance evaluation system in which a dual hot standby configuration apparatus according to a first embodiment of the present invention is an evaluation target.

  This soft error tolerance evaluation system includes an electronic device 1 that is an evaluation target and an irradiation system 101 that generates a neutron beam and irradiates the evaluation target, and further irradiates a beam stop signal 4a output from the electronic device 1. It is characterized in that the neutron beam 105a can be controlled in synchronization with the operation of the electronic apparatus 1 by inputting to the beam stop mechanism 103 of the system 101.

  The outline of the soft error evaluation method by this system is as follows. The electronic device 1 in operation is irradiated with the neutron beam 105a, the occurrence of the system error is observed by the control terminal 6, the number of errors finally counted, and the irradiation system The soft error rate of the electronic apparatus 1 can be estimated based on the neutron dose (fluence) measured by the detector 104 of 101.

  Since the configuration of the irradiation system 101 is the same as the configuration of FIG. 10 described above, description thereof is omitted here. Regarding the beam stop mechanism 103, the neutron beam 105a can be stopped not only by the beam stop signal 4a but also by a beam stop signal 106a from the control terminal 106.

The electronic device 1 having a dual hot standby configuration includes two identical information control units 2-2 ′.
And a redundant unit controller 3 and a beam stop signal generator 4. As an initial state, it is assumed here that the information control unit 2 is operated as an execution system unit and the other unit 2 ′ is operated as a standby system unit. Because of the hot standby method, it is assumed that both units perform the same operation while performing synchronization control.

  Here, the information control unit refers to a hardware system having an information processing function such as a router and a server and a monitoring control function of a train and an elevator. As an example of the information control unit, FIG. 2 shows a configuration of a unit having a router function. The router function is a function for interconnecting two or more networks and exchanging information packets between the networks.

  This unit mainly includes a network processor 21, a packet transmission / reception unit 22, a memory 23, and a general-purpose processor 24. An information packet 22a input from a network (not shown) is received by the packet transmitting / receiving unit 22, and then the header information added to the packet is analyzed by the network processor 21, and the memory 23 in which the network path information is stored. The header information is added again with reference to FIG.

  The general-purpose processor 24 performs connection confirmation between routers and networks, diagnosis / monitoring of its own operating state, and the like. It is assumed that error information detected inside the unit, system information indicating in which system the unit is operating, and the like are stored in the status register 25 in the general-purpose processor.

  The error information in the information control unit includes error information such as a time-out error due to packet congestion, path information memory data abnormality (parity error), an uncontrollable state due to the processor stack, and the like. Of these errors, errors other than those caused by hardware failure can be restored to normal by restarting or re-applying the apparatus power.

  The redundant unit control unit 3 constantly monitors error information of the information control units 2 to 2 ′, and performs system switching control of the unit and restart control of the error unit when an error occurs. FIG. 3 shows a configuration example of the redundant unit control unit 3. The redundant unit control unit 3 includes an error monitoring unit 31, a unit switching unit 32, and a restart control unit 33.

  The error monitoring unit 31 constantly monitors the status information inside both units, and acquires error information 2a and 2a ′. When error information is detected, a unit switching signal 31 a is output to the unit switching unit 32.

  Based on the switching signal 31a from the error monitoring unit 31, the unit switching unit 32 outputs selection signals 2b and 2b ′ indicating which of the units 2 and 2 ′ is the execution system, and indicates the restart of the unit in an error state. The restart signal 32 a is output to the restart control unit 33.

  The restart control unit 33 includes a restart start command unit 34, a restart completion monitoring unit 35, and a delay unit 36, and performs restart control of the error unit.

  The restart start command unit 34 outputs the restart start signal 2c or 2c ′ to the unit in an error state based on the restart signal 32a received from the unit switching unit 32. At this time, the signal is output via the delay unit 36 for adjusting the restart start timing. Furthermore, the restart start command unit 34 outputs a restart start signal 3a indicating that restart has been started to the restart completion monitoring unit 35 and the beam stop signal generating unit 4.

  When the restart completion monitoring unit 35 receives the start signal 3a, the restart completion monitoring unit 35 starts monitoring the status register information in both units and monitors the completion of the restart. When the restart completion is detected, the restart completion signal 3 b is output to the beam stop signal generation unit 4.

  When the restart completion signal is received and it is confirmed that there is no error in both units, a synchronous operation is started between the execution system unit and the standby system unit. Here, it is assumed that the information control units 2, 2 ′ are not restarted at the same time other than restarting the entire electronic device 1.

  Next, the beam stop signal generation unit 4 in the apparatus will be described. Based on the restart start timing and restart end timing of the error unit, the beam stop signal generation unit 4 generates a pulse signal that represents the restart period as a pulse width, and uses the signal as a beam stop signal 4a. Is output to the beam stop mechanism 103.

  FIG. 4 shows an example of the configuration of the beam stop signal generator 4 (the clock is not shown). Here, the rise of the restart start signal 3a and the restart completion signal 3b indicate the timing. The pulse generation unit 41 includes two rising detection circuits 42 and a start / stop circuit 43.

  The rising edge detection circuit 42 can detect rising edges of the restart start signal 3a and the restart completion signal 3b that are respectively input, and can maintain the Hi level. The start / stop circuit 43 generates a high-level pulse signal from when the start signal is received until the stop signal is received. An operation example up to pulse generation is shown in a timing chart in the figure. As a result, the beam stop signal generation unit 4 outputs the time required for restart as a beam stop signal 4a expressed in pulse width.

  There are various types of beam stop mechanisms 103 of the irradiation system 101, and the time from when a stop signal is received until the beam is completely stopped (stop time) is different. The beam stop mechanism 103 in the present embodiment assumes an electromagnet beam shutter, and stops the output of the neutron beam by applying a strong magnetic field to the proton beam and repelling the proton beam. In this case, the beam can be stopped on the order of several microseconds after receiving the stop signal.

  However, a mechanical concrete shutter or the like may require a time on the order of several seconds. For this reason, the timing at which the neutron beam actually stops completely may be delayed from the timing of the restart start signal 3a generated by the redundant unit controller 3, and in this case, the reboot starts while still being irradiated. Therefore, there is a possibility that the above-described multiple failure may occur.

  Therefore, as shown in FIG. 3, a delay element 36 capable of setting an arbitrary delay time is provided at the output of the restart control unit 33 that generates the restart start signals 2c and 2c ′ of the information control unit. If the stop time of the beam stop mechanism 103 is later than the reboot start timing, a delay time considering the response time of the beam stop mechanism 103 is input to the delay element 36, and the reboot is performed with the beam completely stopped. Can start.

  However, the above configuration is not limited to the provision of the delay element. For example, the restart control unit 33 of the redundant unit control unit 3 is controlled so that restart is started after the beam is completely stopped, and the restart target unit Alternatively, a restart start signal may be transmitted.

FIG. 5 is a flowchart showing an example of the flow of the soft error tolerance evaluation method in the present embodiment (FIG. 1).
First, although not shown, the output condition of the neutron beam 105a is set in the irradiation system 101, and the output of the neutron beam 105a is stopped.

Next, the electronic device 1 to be evaluated is installed downstream of the neutron beam line, and the electronic device 1 is activated (S100).
Next, initialization is performed as necessary, and the operation of the electronic apparatus 1 is started (S101). Here, the operation indicates a state in which the same processing as in actual use is continued. In addition, an operation state using a test program for shipping verification and a general benchmark program is also included.

Next, the control terminal 106 cancels the beam stop signal 106a, and starts irradiating the electronic apparatus 1 with the neutron beam 105a (S102). During irradiation, the operating state of the electronic device 1 irradiated with the neutron beam 105a and the presence / absence of a system error are monitored via the control terminal 10 (S103).
Here, when an error is detected by the information control unit 2 or 2 ′ in the electronic apparatus during the beam irradiation, the electronic apparatus 1 identifies the unit in which the error has occurred (S109). For example, the error unit is the execution system. In this case, the standby system unit is switched to the active system unit (S110).

  Next, the electronic apparatus 1 starts a restart process for the identified error unit. At the same time, the beam stop signal 4a output from the beam stop signal generation unit 4 becomes Hi level at the timing of the restart start signal, and the beam stop mechanism 103 of the irradiation system 101 stops the output of the neutron beam (S111).

When the restart of the error unit is completed (S112), the beam stop signal 4a output from the beam stop signal generation unit of the electronic apparatus 1 becomes Lo level, and the beam stop mechanism 103 of the irradiation system 101 restarts the output of the neutron beam. (S113), observation of soft error is continued.
That is, when the error unit is restarted, the irradiation of the neutron beam is automatically stopped according to the beam stop signal 77a in which the restart time is represented by the pulse width.

  Next, when a system error that cannot be recovered even by restarting, such as multiple faults, occurs in the electronic apparatus 1 during irradiation (S104), the control terminal 106 transmits a beam stop signal 106a to the beam stop mechanism 103 of the irradiation system 101. Then, the output of the neutron beam is stopped (S105). Also, the observation of soft errors is temporarily suspended.

  Next, all the information related to the error including the status of the system at that time is collected from the electronic device 1 (S106). After collecting the error information, the entire electronic device is restarted (S107).

  Next, if the measurement is to be performed again, the process returns to S101 to continue the soft error evaluation (S108). In general, this flow is repeated, and error information is acquired several times to several tens of times. If re-measurement is not performed, this software error evaluation ends.

  The electronic device having a redundant configuration in the present embodiment is not limited to the device in which the information control unit in the housing shown in the present embodiment is made redundant. A redundant configuration in which a plurality of devices are interconnected is also included.

  As described above, according to the electronic apparatus, the evaluation system, and the method for observing the soft error in the soft error tolerance evaluation according to the first embodiment of the present invention, the internal unit of the electronic apparatus is irradiated by neutron beam irradiation. When an error occurs and a partial restart process occurs, the electronic device outputs a beam stop signal that indicates the restart period as a pulse width, and synchronizes with that signal to emit the neutron beam of the irradiation system. By automatically stopping the output, it is possible to suppress the occurrence of multiple errors during restart unique to the soft error acceleration test and improve the reliability of the soft error tolerance evaluation.

  Furthermore, the reliability of the apparatus can be improved by correctly evaluating the superiority of the apparatus and the effect of measures against soft errors in a short time. In addition, a reduction in maintenance costs can be expected as the reliability of the device increases. In addition, since the irradiation time at the time of multiple errors that are wasted during the accelerated test can be reduced as compared with the conventional case, the test efficiency can be improved, that is, the evaluation cost can be reduced.

  In the following, in the FPGA (Field-Programmable Gate Array), the internal logic part has a triple majority redundancy (TMR) configuration, and the error can be automatically recovered by the partial reconfiguration function. An example of a soft error tolerance evaluation system capable of appropriately measuring the soft error rate of a highly reliable FPGA will be described with reference to FIGS.

FIG. 7 is a diagram illustrating a configuration example of a soft error tolerance evaluation system when a highly reliable FPGA according to the second embodiment of the present invention is an evaluation target.
This soft error tolerance evaluation system includes an FPGA 7 that is an evaluation target and an irradiation system 101 that generates a neutron beam and irradiates the evaluation target. Further, a beam stop signal 77a output from the FPGA 7 is used as a beam of the irradiation system 101. It is characterized in that the neutron beam 105a can be controlled in synchronization with the partial reconfiguration operation inside the FPGA by inputting to the stop mechanism 103.

Further, the beam stop signal 77a generated by the FPGA 7 is not generated until the reconfiguration is completed in accordance with the completion of the reconfiguration (restart in the first embodiment) as in the first embodiment. It is characterized in that it is generated by a timer method in which the time required for reconfiguration is set.
Since the outline of the soft error evaluation method is the same as that of the first embodiment, the description thereof is omitted here. Also, the configuration of the irradiation system 101 is the same as the configuration of the first embodiment, and thus the description thereof is omitted here.

  The FPGA 7 to be evaluated includes the same triple logic unit 71, majority decision determination unit 74, partial reconfiguration control unit 75, beam stop signal generation unit 77, delay unit 78, and reconfiguration time setting. The TMR is configured by the register 76 and the logic unit 71 and the majority decision determining unit 74. The three logic units 71 are the same logic circuit, and although specific processing is omitted here, each logic unit performs the same processing on the input signal 7a. The processing results 71a, 71b, 71c of each logic unit are input to the majority decision determination unit 74, and the result of the majority decision is output to the outside of the FPGA 7 as an output signal 7b.

  The majority decision determination unit 74 has an error detection function. The majority of the input data from each logic part is taken. By comparing the three input data, it is possible to identify which logic circuit part is outputting abnormal data. When an error state logic unit is detected in the majority decision determination unit 74, an error detection signal 74 a including information that can specify the logic unit is transmitted to the reconfiguration control unit 75.

  When receiving the error detection signal 74 a from the majority decision determination unit 74, the reconstruction control unit 75 first transmits a reconstruction start signal 75 d to the beam stop signal generation unit 77. Next, a reconfiguration signal is transmitted to the logic unit in error via the delay unit 78, and only the logic unit in the error state is automatically recovered by the partial reconfiguration process.

  As described above, the reconfiguration signals 75a to 75c set a delay time in consideration of the stop time of the beam stop mechanism in the delay unit 78 so that the reconfiguration can be started after the beam is completely stopped. For example, when the output of the logic unit (1) 71 is determined to be an error, the reconfiguration signal 75a is transmitted to the logic unit (1) 71, and reconfiguration is started.

  FIG. 8 is a diagram illustrating a configuration example of the beam stop signal generation unit 77 in the second embodiment of the present invention. The beam stop signal generator 77 includes a pulse generator 80 and a timer 81. Here, the timer 81 is a down counter that counts down every clock cycle from the set initial value.

  The timer 81 receives the time information 76a set in the reconfiguration time setting register 76, and this time information becomes the initial value of the counter. The pulse generation unit 80 performs the same operation as the pulse generation unit 41 shown in the first embodiment.

  When the pulse generator 80 receives the reconstruction start signal 75d from the reconstruction controller 75, the output of the beam stop signal 77a becomes Hi level. At the same time, the timer 81 that has received the reconstruction start signal 75d starts counting down. When the counter reaches 0, the count end signal 81a is input to the pulse generator 80, and the beam stop signal 77a returns to the Lo level. That is, the beam stop signal is generated for the cycle set in the timer after the start of reconstruction. An operation example up to pulse generation is shown in a timing chart in the figure.

  Further, the input / output signals 7a and 7b of the FPGA 7 shown in FIG. 7 are connected to another circuit or control terminal 70 (not shown). From the control terminal 70 via the GUI, in addition to the configuration of the FPGA, reading / writing to the internal memory and the register including the reconfiguration time setting register 76, monitoring of the operating state during neutron beam irradiation, and the output signal 7b Perform expected value determination.

FIG. 9 is a flowchart illustrating an example of the flow of the soft error tolerance evaluation method according to the second embodiment.
First, although not shown in the flow, the output condition of the neutron beam 105a is set in the irradiation system 101, and the beam is stopped. Next, the FPGA 7 to be evaluated is installed downstream of the neutron beam line, and the FPGA 7 is activated (S200).

  Next, programming or initial setting of the FPGA is performed as necessary, and the operation of the FPGA 7 is started (S201). Here, the operation indicates a state in which the same processing as in actual use is continued. In addition, an operation state using a test program for shipping verification and a general benchmark program is also included.

  Next, the beam stop signal 107a is canceled at the control terminal 107, and irradiation of the neutron beam 105a to the FPGA 7 is started (S202). Here, when an error is detected in the logic unit inside the FPGA during irradiation (S203), the FPGA 7 starts a partial reconfiguration process of the logic unit in the specified error state. At the same time, the beam stop signal 4 output from the beam stop signal generator 77 becomes Hi level at the reconstruction start timing, and the beam stop mechanism 103 of the irradiation system 101 stops the output of the neutron beam 105a (S209).

  When the reconfiguration of the error state logic unit is completed (S210), the beam stop signal 77a output from the beam stop signal generation unit 77 becomes Lo level, and the beam stop mechanism 103 of the irradiation system 101 outputs the neutron beam. Is resumed (S211), and the observation of the soft error is continued. That is, when the reconstruction is performed inside the FPGA, the irradiation of the neutron beam is automatically stopped according to the beam stop signal 77a in which the reconstruction time is represented by the pulse width.

  Next, when a system error of the FPGA 7 occurs during irradiation (S204), a beam stop signal 107a is transmitted from the control terminal 107 to the beam stop mechanism 103 of the irradiation system 101, and the output of the neutron beam 105a is stopped (S205). ). Also, the observation of soft errors is temporarily suspended.

  Here, the system error represents an error in which the output from the majority decision determination unit 74 is different from an expected value, a multiple error in the logic unit, or the like. This is caused by destruction of circuit information programmed by a soft error in a configuration memory unique to the FPGA. In this case, all information related to the error is collected including the current status of the FPGA 7 (S206).

When the error information is collected, the entire FPGA 7 is reconfigured (S207). Next, if the measurement is performed again, the process returns to S201 and the soft error evaluation is continued in the same manner. In general, this flow is repeated, and error information is acquired several times to several tens of times.
When the re-measurement is not performed, the soft error evaluation is ended (S208).

  Here, the timer 81 in the beam stop signal generation unit 77 of the present embodiment may be configured by an up counter in addition to the down counter. The time information 76a set in the timer may be configured to be selected from a plurality of time information. Further, the number of reconstruction time setting registers is not limited to one, and a configuration in which a plurality of times can be set may be used.

  As described above, according to the electronic apparatus, the evaluation system, and the method for observing the soft error in the soft error tolerance evaluation described in the second embodiment of the present invention, the TMR is irradiated with the neutron beam. When an error occurs in the logic part of the FPGA of the configuration and a partial reconfiguration process occurs, a beam stop signal indicating the reconfiguration time in pulse width is output from the FPGA side and synchronized with the signal. By automatically stopping the neutron beam output of the irradiation system, it is possible to suppress the occurrence of multiple errors during reconstruction specific to the soft error acceleration test and improve the reliability of the soft error tolerance evaluation.

  Furthermore, the reliability of the apparatus can be improved by correctly evaluating the superiority of the apparatus and the effect of measures against soft errors in a short time. In addition, a reduction in maintenance costs can be expected as the reliability of the device increases. In addition, since the irradiation time at the time of multiple errors that are wasted during the accelerated test can be reduced as compared with the conventional case, the test efficiency can be improved, that is, the evaluation cost can be reduced.

  In the third embodiment of the present invention, an example in which the beam stop signal generation unit in the soft error tolerance evaluation system is made highly resistant will be described.

  The beam stop signal generation unit 4 in the soft error tolerance evaluation system does not malfunction such as erroneously outputting a beam stop signal during evaluation due to the influence of accelerated environmental radiation, that is, compared with other components. High soft error tolerance is desirable.

  FIG. 6 shows an example of the configuration of a beam stop signal generator that has improved resistance to environmental radiation. A beam stop signal generation unit 400 shown in FIG. 6 has a pulse generation unit 41 having a triple majority redundancy (TMR) configuration, and includes three pulse generation units 41 and a majority determination unit 60. Even if one pulse generation unit 41 malfunctions, if the other two pulse generation units 41 ′ to 41 ″ are normal outputs, the majority output determination unit 60 masks the erroneous output and outputs a normal beam stop signal. Can be output.

  In FIG. 6, the beam stop signal generation unit is configured to have a TMR configuration to prevent an erroneous beam stop signal from being output. However, the function of the beam stop signal generation unit 4 is added to the information control unit 2. In comparison, a semiconductor device that is relatively less susceptible to soft errors may be used. Since soft errors due to radiation tend to increase with the miniaturization of semiconductor processes, for example, a semiconductor device manufactured by an old manufacturing process (on the order of several hundred nanometers) may be used. Further, the beam stop signal generation unit 3 may be configured as an external module that can be attached to and detached from the electronic device so that the beam stop signal generation unit 3 can be arranged away from the position where the neutron beam does not hit during the soft error acceleration test.

  As described above, according to the electronic apparatus, the evaluation system, and the method for observing the soft error in the soft error tolerance evaluation described in the third embodiment of the present invention, the malfunction of the beam stop signal generation unit itself is detected. The reliability of the soft error tolerance evaluation can be improved.

  Furthermore, the reliability of the apparatus can be improved by correctly evaluating the superiority of the apparatus and the effect of measures against soft errors in a short time. In addition, a reduction in maintenance costs can be expected as the reliability of the device increases. In addition, since the irradiation time at the time of multiple errors that are wasted during the accelerated test can be reduced as compared with the conventional case, the test efficiency can be improved, that is, the evaluation cost can be reduced.

  It should be noted that the present invention is not limited to the above-described embodiments, and includes various modifications. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily described. However, the present invention is not limited to the one having all the configurations. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

  Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

DESCRIPTION OF SYMBOLS 1,200 ... Electronic device, 2 ... Information control unit, 3 ... Redundant unit control part, 4, 77, 400 ... Beam stop signal generation part 10, 70, 106, 107, 201 ... Control terminal, 7 ... FPGA, 21 Network processor 22 Packet transmission / reception unit 23 Memory 24 General-purpose processor 25 Status register 31 Error monitoring unit 32 Unit switching unit 33 Restart control unit 34 Restart start command unit 35 ... Restart completion monitoring unit, 36, 78 ... Delay unit, 41, 80 ... Pulse generation unit, 42 ... Rise detection circuit, 43 ... Start / stop circuit, 60, 74 ... Majority determination unit, 71 ... Logic unit, 75 ... reconfiguration controller, 76 ... reconfiguration time setting register, 81 ... timer, 101 ... irradiation system, 102 ... accelerator, 103 ... beam stop mechanism, 104 ... detector, 05 ... target, 202 ... diagnosis unit

Claims (20)

An information control unit having an error detection means for detecting an error;
Based on the error information of the information control unit, a unit control unit having a reboot control unit for transmitting a reboot start signal of the information control unit in which an error has occurred;
A signal transmission unit that detects a reboot start signal from the unit control unit and transmits a signal to the outside when the reboot start signal is detected;
When an error occurs in the information control unit, the information control unit is rebooted by the reboot start signal, and a signal is transmitted to the outside by the signal transmission unit.   The electronic device according to claim 1, wherein the signal transmission unit includes a pulse signal generation unit, and transmits a pulse signal in which a reboot period of the information control unit is represented by a pulse width. The signal transmission unit includes a plurality of pulse signal generation units, and a majority decision determination unit that determines majority of pulse signal transmission based on the pulse signals generated by the plurality of pulse signal generation units,
2. The electronic device according to claim 1, wherein when the majority determination unit determines that the pulse signal can be transmitted, a pulse signal representing a reboot period of the information control unit in a pulse width is transmitted. The reboot control unit has reboot completion signal transmission means for transmitting a signal based on reboot completion information of the information control unit,
The signal transmission unit transmits a pulse signal representing a reboot period of the information control unit in a pulse width based on a reboot start signal from the reboot control unit and a reboot completion signal from the reboot completion signal transmission unit. The electronic device according to claim 2, wherein the electronic device is characterized by the following. The signal transmission unit includes a time measurement unit,
The time measuring means measures the time for the set time information when detecting the reboot start signal from the reboot control unit,
When time measurement for the time information is completed, a time measurement completion signal is transmitted to the pulse signal generation unit,
The pulse signal representing a reboot period of the information control unit in a pulse width is transmitted based on a reboot start signal from the reboot control unit and a time measurement completion signal from the time measuring means. 4. The electronic device according to any one of 2 and 3.   The electronic device according to claim 1, wherein the reboot control unit includes a delay unit that delays transmission of a reboot start signal to the information control unit. A plurality of the information control units;
The unit control unit performs switching between an execution unit and a standby unit in a plurality of information control units, and a unit switching unit that transmits a signal to the reboot control unit when unit switching is completed,
An error monitoring unit that performs switching start control of the unit switching unit based on error information of a plurality of information control units;
The electronic device according to claim 1, wherein the reboot control unit transmits a reboot start signal when detecting a signal from the unit switching unit. An irradiation system for irradiating a radiation beam;
An information control unit having an error detection means for detecting an error;
Based on the error information of the information control unit, a unit control unit having a reboot control unit for transmitting a reboot start signal of the information control unit in which an error has occurred;
An electronic device having a signal transmission unit that detects a reboot start signal from the unit control unit and transmits an irradiation stop signal to the irradiation system when the reboot start signal is detected, and
When an error occurs in the information control unit, the information control unit is rebooted by the reboot start signal, and an irradiation stop signal is transmitted to the irradiation system by the signal transmission unit, and irradiation of the irradiation system is stopped. A soft error tolerance evaluation system characterized by   9. The soft error tolerance evaluation system according to claim 8, wherein the signal transmission unit includes a pulse signal generation unit, and transmits a pulse signal representing a reboot period of the information control unit by a pulse width. The signal transmission unit includes a plurality of pulse signal generation units, and a majority decision determination unit that determines majority of pulse signal transmission based on the pulse signals generated by the plurality of pulse signal generation units,
9. The soft error resistance according to claim 8, wherein when the majority decision determination unit determines that the pulse signal can be transmitted, a pulse signal representing a reboot period of the information control unit in a pulse width is transmitted. Evaluation system. The reboot control unit has reboot completion signal transmission means for transmitting a signal based on reboot completion information of the information control unit,
The signal transmission unit transmits a pulse signal representing a reboot period of the information control unit in a pulse width based on a reboot start signal from the reboot control unit and a reboot completion signal from the reboot completion signal transmission unit. The soft error tolerance evaluation system according to any one of claims 9 and 10, wherein The signal transmission unit includes a time measurement unit,
The time measuring means measures the time for the set time information when detecting the reboot start signal from the reboot control unit,
When time measurement for the time information is completed, a time measurement completion signal is transmitted to the pulse signal generation unit,
The pulse signal representing a reboot period of the information control unit in a pulse width is transmitted based on a reboot start signal from the reboot control unit and a time measurement completion signal from the time measuring means. The soft error tolerance evaluation system according to any one of 9 and 10.   The reboot control unit includes delay means for delaying transmission of a reboot start signal to the information control unit, and the information depends on a time from when the irradiation system receives the irradiation stop signal until the irradiation stops. 9. The soft error tolerance evaluation system according to claim 8, wherein transmission of a reboot start signal to the control unit is delayed. The electronic device includes a plurality of the information control units,
The unit control unit performs switching between an execution unit and a standby unit in a plurality of information control units, and a unit switching unit that transmits a signal to the reboot control unit when unit switching is completed,
An error monitoring unit that performs switching start control of the unit switching unit based on error information of a plurality of information control units;
The soft error tolerance evaluation system according to claim 8, wherein the reboot control unit transmits a reboot start signal when detecting a signal from the unit switching unit. A soft error resistance evaluation method for evaluating the soft error resistance of an electronic device by irradiating radiation,
Irradiating an electronic device with a radiation beam by a radiation beam irradiation system;
Detecting an error in the electronic device;
Rebooting the electronic device when an error is detected in the detection step;
And a step of stopping beam irradiation of the radiation beam irradiation system when an error is detected in the detection step.   The step of stopping the beam irradiation includes a step of generating a pulse signal indicating a period from the start to the end of reboot of the electronic device by a pulse width, and the beam irradiation of the neutron beam irradiation system is performed according to the pulse signal. The soft error tolerance evaluation method according to claim 15, wherein the method is stopped.   The soft error tolerance evaluation method according to claim 16, wherein in the step of generating the pulse signal, a plurality of pulses are generated, and a majority decision is made as to whether or not beam irradiation can be stopped based on the plurality of pulse signals.   16. The soft error resistance evaluation method according to claim 15, wherein the step of stopping the beam irradiation stops the beam irradiation in a period from the start to the completion of reboot of the electronic device.   The period from the start of reboot of the electronic device to completion is set as a preset time, the time is measured from the start of reboot, and beam irradiation is stopped when the set time is measured. The soft error tolerance evaluation method described.   The soft error tolerance evaluation method according to claim 15, wherein the rebooting of the electronic device is executed after beam irradiation of the radiation beam irradiation system is started.

Images